CVE-2026-31843CRITICAL 9.8EPSS p66.2%

CVE-2026-31843CVE-2026-31843

Description

The goodoneuz/pay-uz Laravel package (<= 2.2.24) contains a critical vulnerability in the /payment/api/editable/update endpoint that allows unauthenticated attackers to overwrite existing PHP payment hook files. The endpoint is exposed via Route::any without authentication middleware, enabling remote access without credentials.

Scoring

CVSS 3.19.8 (CRITICAL)
VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS1.17% probability of exploitation · percentile 66.2% · 2026-10-05T12:00:23Z
Published2026-04-16
Last modified2026-08-10

Underlying weaknesses· 1

CWE-284

References

  1. https://github.com/goodoneuz/pay-uz/blob/master/src/Http/Controllers/ApiController.php
  2. https://github.com/goodoneuz/pay-uz/blob/master/src/routes/web.php
  3. https://github.com/shaxzodbek-uzb/pay-uz
  4. https://packagist.org/packages/goodoneuz/pay-uz

1

TypeTargetConfidenceTier
WeaknessImproper Access Controlcwe-2840%live

Related by meaning· 6

Nearest entities by semantic similarity across the cs-graph corpus.

CVE
Laravel Ignition File Upload Vulnerability
CVE
CVE-2025-28942
CVE
CVE-2025-8187
CVE
CVE-2025-8233
CVE
CVE-2025-8189
CVE
CVE-2025-8186
Sourced from NVD + FIRST.org EPSS. Curated for EU compliance use cases by Adam Lundqvist, Founder at SQUR.